

<!DOCTYPE html>
<!--[if IE 8]><html class="no-js lt-ie9" lang="en" > <![endif]-->
<!--[if gt IE 8]><!--> <html class="no-js" lang="en" > <!--<![endif]-->
<head>
  <meta charset="utf-8">
  
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  
  <title>Fakeroot &mdash; Singularity container 3.5 documentation</title>
  

  
  
    <link rel="shortcut icon" href="_static/favicon.png"/>
  
  
  

  
  <script type="text/javascript" src="_static/js/modernizr.min.js"></script>
  
    
      <script type="text/javascript" id="documentation_options" data-url_root="./" src="_static/documentation_options.js"></script>
        <script src="_static/jquery.js"></script>
        <script src="_static/underscore.js"></script>
        <script src="_static/doctools.js"></script>
        <script src="_static/language_data.js"></script>
        <script src="_static/js/ga.js"></script>
    
    <script type="text/javascript" src="_static/js/theme.js"></script>

    

  
  <link rel="stylesheet" href="_static/css/theme.css" type="text/css" />
  <link rel="stylesheet" href="_static/pygments.css" type="text/css" />
  <link rel="stylesheet" href="_static/css/custom.css" type="text/css" />
    <link rel="index" title="Index" href="genindex.html" />
    <link rel="search" title="Search" href="search.html" />
    <link rel="next" title="容器的签名和验证" href="signNverify.html" />
    <link rel="prev" title="支持Docker和OCI容器" href="singularity_and_docker.html" /> 
</head>

<body class="wy-body-for-nav">

   
  <div class="wy-grid-for-nav">
    
    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
      <div class="wy-side-scroll">
        <div class="wy-side-nav-search" >
          

          
            <a href="index.html" class="icon icon-home"> Singularity container
          

          
            
            <img src="_static/logo.png" class="logo" alt="Logo"/>
          
          </a>

          
            
            
              <div class="version">
                3.5
              </div>
            
          

          
<div role="search">
  <form id="rtd-search-form" class="wy-form" action="search.html" method="get">
    <input type="text" name="q" placeholder="Search docs" />
    <input type="hidden" name="check_keywords" value="yes" />
    <input type="hidden" name="area" value="default" />
  </form>
</div>

          
        </div>

        <div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="main navigation">
          
            
            
              
            
            
              <ul>
<li class="toctree-l1"><a class="reference internal" href="introduction.html">介绍</a></li>
<li class="toctree-l1"><a class="reference internal" href="quick_start.html">快速入门</a></li>
<li class="toctree-l1"><a class="reference internal" href="security.html">Singularity安全</a></li>
</ul>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="build_a_container.html">Build容器</a></li>
<li class="toctree-l1"><a class="reference internal" href="definition_files.html">Definition文件</a></li>
<li class="toctree-l1"><a class="reference internal" href="build_env.html">Build环境</a></li>
<li class="toctree-l1"><a class="reference internal" href="singularity_and_docker.html">Singularity和Docker</a></li>
<li class="toctree-l1 current"><a class="current reference internal" href="#">Fakeroot</a><ul>
<li class="toctree-l2"><a class="reference internal" href="#id2">概述</a></li>
<li class="toctree-l2"><a class="reference internal" href="#id3">安全性和限制</a><ul>
<li class="toctree-l3"><a class="reference internal" href="#id4">文件系统</a></li>
<li class="toctree-l3"><a class="reference internal" href="#id5">网络</a></li>
</ul>
</li>
<li class="toctree-l2"><a class="reference internal" href="#id6">依赖和配置</a></li>
<li class="toctree-l2"><a class="reference internal" href="#id7">使用</a><ul>
<li class="toctree-l3"><a class="reference internal" href="#build">Build</a></li>
<li class="toctree-l3"><a class="reference internal" href="#id8">例子</a><ul>
<li class="toctree-l4"><a class="reference internal" href="#definitionbuild">从definition文件build容器:</a></li>
<li class="toctree-l4"><a class="reference internal" href="#ping">容器内ping:</a></li>
<li class="toctree-l4"><a class="reference internal" href="#http">Http服务器:</a></li>
</ul>
</li>
</ul>
</li>
</ul>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="signNverify.html">签名和认证</a></li>
<li class="toctree-l1"><a class="reference internal" href="key_commands.html">Key管理</a></li>
<li class="toctree-l1"><a class="reference internal" href="encryption.html">容器加密</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="endpoint.html">容器仓库</a></li>
<li class="toctree-l1"><a class="reference internal" href="cloud_library.html">Cloud Library</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="bind_paths_and_mounts.html">路径映射</a></li>
<li class="toctree-l1"><a class="reference internal" href="persistent_overlays.html">持久化Overlay</a></li>
<li class="toctree-l1"><a class="reference internal" href="running_services.html">运行服务</a></li>
<li class="toctree-l1"><a class="reference internal" href="environment_and_metadata.html">环境变量和元数据</a></li>
<li class="toctree-l1"><a class="reference internal" href="oci_runtime.html">OCI运行时</a></li>
<li class="toctree-l1"><a class="reference internal" href="plugins.html">插件</a></li>
<li class="toctree-l1"><a class="reference internal" href="security_options.html">安全选项</a></li>
<li class="toctree-l1"><a class="reference internal" href="networking.html">网络选项</a></li>
<li class="toctree-l1"><a class="reference internal" href="cgroups.html">Cgroups</a></li>
<li class="toctree-l1"><a class="reference internal" href="mpi.html">MPI应用</a></li>
<li class="toctree-l1"><a class="reference internal" href="gpu.html">GPU支持</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="contributing.html">Contributing</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="appendix.html">Appendix</a></li>
<li class="toctree-l1"><a class="reference internal" href="cli.html">Command Line Reference</a></li>
</ul>

            
          
        </div>
      </div>
    </nav>

    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap">

      
      <nav class="wy-nav-top" aria-label="top navigation">
        
          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
          <a href="index.html">Singularity container</a>
        
      </nav>


      <div class="wy-nav-content">
        
        <div class="rst-content style-external-links">
        
          















<div role="navigation" aria-label="breadcrumbs navigation">

  <ul class="wy-breadcrumbs">
    
      <li><a href="index.html">Docs</a> &raquo;</li>
        
      <li>Fakeroot</li>
    
    
      <li class="wy-breadcrumbs-aside">
        
            
            
              <a href="https://github.com/sylabs/singularity-userdocs/blob/master/fakeroot.rst" class="fa fa-github"> Edit on GitHub</a>
            
          
        
      </li>
    
  </ul>

  
  <hr/>
</div>
          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
           <div itemprop="articleBody">
            
  <div class="section" id="fakeroot">
<span id="id1"></span><h1>Fakeroot<a class="headerlink" href="#fakeroot" title="Permalink to this headline">¶</a></h1>
<div class="section" id="id2">
<h2>概述<a class="headerlink" href="#id2" title="Permalink to this headline">¶</a></h2>
<p>Fakeroot(也叫做rootless)允许host上的一个非root用户在容器中看起来像是root用户。 这是基于linux的
<a class="reference external" href="http://man7.org/linux/man-pages/man7/user_namespaces.7.html">user namespace UID/GID mapping</a> 实现。</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>Fakeroot需要Linux内核 &gt;= 3.8，推荐是 &gt;= 3.18</p>
</div>
<p>Fakeroot只在容器内并且请求的namespaces内看起来像有root权限:</p>
<blockquote>
<div><ul class="simple">
<li><p>能对自己是owner的文件设置新的user和group</p></li>
<li><p>使用su/sudo命令可以修改user/group的id</p></li>
<li><p>容器内，在请求到的namespace(network, ipc, uts)下具有root权限</p></li>
</ul>
</div></blockquote>
</div>
<div class="section" id="id3">
<h2>安全性和限制<a class="headerlink" href="#id3" title="Permalink to this headline">¶</a></h2>
<div class="section" id="id4">
<h3>文件系统<a class="headerlink" href="#id4" title="Permalink to this headline">¶</a></h3>
<p>容器内fakeroot用户不能访问和修改原来在host上他本就不能访问的文件，
所以 fakeroot用户不能访问host上的 <code class="docutils literal notranslate"><span class="pre">/etc/shadow</span></code> 和 <code class="docutils literal notranslate"><span class="pre">/root</span></code> 目录。</p>
<p>另外, fakeroot用户在容器内创建的文件在容器内看到的owner是 <code class="docutils literal notranslate"><span class="pre">root:root</span></code>，但是在容器外，你会看到文件的owner变成了 <code class="docutils literal notranslate"><span class="pre">user:group</span></code>。
下面的例子中，host上的用户 “user”映射为容器内的fakeroot用户。</p>
<table class="docutils align-default">
<colgroup>
<col style="width: 49%" />
<col style="width: 51%" />
</colgroup>
<thead>
<tr class="row-odd"><th class="head"><p>UID inside container</p></th>
<th class="head"><p>UID outside container</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td><p>0 (root)</p></td>
<td><p>1000 (user)</p></td>
</tr>
<tr class="row-odd"><td><p>1 (daemon)</p></td>
<td><p>131072 (non-existent)</p></td>
</tr>
<tr class="row-even"><td><p>2 (bin)</p></td>
<td><p>131073 (non-existent)</p></td>
</tr>
<tr class="row-odd"><td><p>…</p></td>
<td><p>…</p></td>
</tr>
<tr class="row-even"><td><p>65536</p></td>
<td><p>196607</p></td>
</tr>
</tbody>
</table>
<p>这意味这在容器内，如果以容器内的用户 <code class="docutils literal notranslate"><span class="pre">bin</span></code> 创建了一个文件, 那么你在容器外看到的owner将是 <code class="docutils literal notranslate"><span class="pre">131073:131073</span></code>。
Singularity管理员要确保容器内外用户的UID/GID没有重叠。</p>
</div>
<div class="section" id="id5">
<h3>网络<a class="headerlink" href="#id5" title="Permalink to this headline">¶</a></h3>
<p>如果singualrity在运行命令的时候没有加上 <code class="docutils literal notranslate"><span class="pre">--net</span></code> 标记, 容器内的fakeroot用户将不能 <code class="docutils literal notranslate"><span class="pre">ping</span></code> 或者绑定一个容器服务到1024以下的端口。</p>
<p>加上 <code class="docutils literal notranslate"><span class="pre">--net</span></code> 标记， 在容器内，fakeroot用户就有网络的所有权限，用户可以绑定1024以下的端口，
可以ping，可以管理防火墙规则等。在容器中做的任何网络上的改动不会影响host网络。</p>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>当然，一个非root用户也不能西永下面的命令映射1024以下的端口: <code class="docutils literal notranslate"><span class="pre">--network-args=&quot;portmap=80:80/tcp&quot;</span></code>。</p>
</div>
<div class="admonition warning">
<p class="admonition-title">Warning</p>
<p>非root安装的singularity，或者 <code class="docutils literal notranslate"><span class="pre">singularity.conf</span></code> 文件中 <code class="docutils literal notranslate"><span class="pre">allow</span> <span class="pre">setuid</span> <span class="pre">=</span> <span class="pre">no</span></code> 的情况下，将不能使用 <code class="docutils literal notranslate"><span class="pre">fakeroot</span></code> 网络。</p>
</div>
</div>
</div>
<div class="section" id="id6">
<h2>依赖和配置<a class="headerlink" href="#id6" title="Permalink to this headline">¶</a></h2>
<p>Fakeroot 依赖于用户的映射  <code class="docutils literal notranslate"><span class="pre">/etc/subuid</span></code> 和做的映射 <code class="docutils literal notranslate"><span class="pre">/etc/subgid</span></code>, 所以你的名字需要在这两个文件中正确映射(详见管理员文档)，
如果你不能编辑这两个文件，告诉管理员。</p>
<p>Singularity 3.5 提供了一个新的命令 <code class="docutils literal notranslate"><span class="pre">singularity</span> <span class="pre">config</span> <span class="pre">fakeroot</span></code> 来配置 <code class="docutils literal notranslate"><span class="pre">/etc/subuid</span></code> 和 <code class="docutils literal notranslate"><span class="pre">/etc/subgid</span></code>。
mappings from the Singularity command line. 你需要是root用户或使用 <code class="docutils literal notranslate"><span class="pre">sudo</span></code> 去运行 <code class="docutils literal notranslate"><span class="pre">config</span> <span class="pre">fakeroot</span></code> 命令,
更多细节，请查看管理员文档。</p>
</div>
<div class="section" id="id7">
<h2>使用<a class="headerlink" href="#id7" title="Permalink to this headline">¶</a></h2>
<p>如果你的用户和组在 <code class="docutils literal notranslate"><span class="pre">subuid</span></code> 和 <code class="docutils literal notranslate"><span class="pre">subgid</span></code> 已经映射好，你可以通过选项 <code class="docutils literal notranslate"><span class="pre">--fakeroot</span></code> 或者 <code class="docutils literal notranslate"><span class="pre">-f</span></code> 使用fakeroot特性。</p>
<p>下面这些命令可以使用 <code class="docutils literal notranslate"><span class="pre">--fakeroot</span></code> 选项:</p>
<blockquote>
<div><ul class="simple">
<li><p><code class="docutils literal notranslate"><span class="pre">shell</span></code></p></li>
<li><p><code class="docutils literal notranslate"><span class="pre">exec</span></code></p></li>
<li><p><code class="docutils literal notranslate"><span class="pre">run</span></code></p></li>
<li><p><code class="docutils literal notranslate"><span class="pre">instance</span> <span class="pre">start</span></code></p></li>
<li><p><code class="docutils literal notranslate"><span class="pre">build</span></code></p></li>
</ul>
</div></blockquote>
<div class="section" id="build">
<h3>Build<a class="headerlink" href="#build" title="Permalink to this headline">¶</a></h3>
<p>使用fakeroot，一个普通用户就有可能从definition文件build容器。
使用fakeroot，有些bootstrap在创建块设备的时候(比如 <code class="docutils literal notranslate"><span class="pre">/dev/null</span></code>)可能不能成功，Singularity使用seccomp告诉程序
块设备创建是否成功。 bootstrap是 <code class="docutils literal notranslate"><span class="pre">yum</span></code> 的时候是可以成功的，可能其它的 bootstraps也能成功，但已知 <code class="docutils literal notranslate"><span class="pre">debootstrap</span></code> 是不能成功的。</p>
</div>
<div class="section" id="id8">
<h3>例子<a class="headerlink" href="#id8" title="Permalink to this headline">¶</a></h3>
<div class="section" id="definitionbuild">
<h4>从definition文件build容器:<a class="headerlink" href="#definitionbuild" title="Permalink to this headline">¶</a></h4>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>singularity build --fakeroot /tmp/test.sif /tmp/test.def
</pre></div>
</div>
</div>
<div class="section" id="ping">
<h4>容器内ping:<a class="headerlink" href="#ping" title="Permalink to this headline">¶</a></h4>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>singularity exec --fakeroot --net docker://alpine ping -c1 8.8.8.8
</pre></div>
</div>
</div>
<div class="section" id="http">
<h4>Http服务器:<a class="headerlink" href="#http" title="Permalink to this headline">¶</a></h4>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>singularity run --fakeroot --net --network-args=&quot;portmap=8080:80/tcp&quot; -w docker://nginx
</pre></div>
</div>
</div>
</div>
</div>
</div>


           </div>
           
          </div>
          <footer>
  
    <div class="rst-footer-buttons" role="navigation" aria-label="footer navigation">
      
        <a href="signNverify.html" class="btn btn-neutral float-right" title="容器的签名和验证" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right"></span></a>
      
      
        <a href="singularity_and_docker.html" class="btn btn-neutral float-left" title="支持Docker和OCI容器" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left"></span> Previous</a>
      
    </div>
  

  <hr/>

  <div role="contentinfo">
    <p>
        &copy; Copyright 2017-2019, Sylabs Inc

    </p>
  </div>
  Built with <a href="http://sphinx-doc.org/">Sphinx</a> using a <a href="https://github.com/rtfd/sphinx_rtd_theme">theme</a> provided by <a href="https://readthedocs.org">Read the Docs</a>. 

</footer>

        </div>
      </div>

    </section>

  </div>
  


  <script type="text/javascript">
      jQuery(function () {
          SphinxRtdTheme.Navigation.enable(true);
      });
  </script>

  
  
    
   

</body>
</html>